Set risk level rules for vendor intake in Titan AI

Risk-level rules automatically turn your intake form answers and risk score into a risk level for each vendor. Each rule is a condition, or a combination of conditions, paired with the risk level it should produce. When a submission comes in, Titan AI checks all your rules and assigns the highest risk level among the matching rules. If no rule matches, the vendor gets your default risk level instead.

Before you begin

Risk level rules are built from your vendor intake form's questions, so you'll need an existing form before you can set them up. See Set up vendor intake in Titan AI if you haven't created one yet.

To use the risk score in your rules, set up scoring first. See Set a risk score for vendor intake in Titan AI.

Build a risk level rule

1. Go to My Network > Vendor Intake, open the Form builder, and select the Risk rules tab.
2. Select Add rule, then choose the questions and answers the rule should check. A single rule can check just one question, or combine several, for example "data type shared" AND "business impact", and you can nest a small number of these groups together for more complex conditions. You can also add the Risk score, or a score group, as a condition. See Use the risk score or a group total as a condition.
3. Choose the risk level the rule should produce when its condition is met, for example, High.
4. Add as many rules as you need, then arrange them by priority. Rules are checked top to bottom, and only the first match is used, so put your most specific conditions above your more general ones.
5. Set a default risk level for vendors whose answers don’t match any of your rules.
6. Use dry run to test your rules before publishing: select sample answers to see which risk level they’d produce, and adjust the rules or their order if the result isn’t what you expected.

Use the risk score or a group total as a condition

Besides answers, a rule can check how much a vendor scored. Add one of these as a condition:

• Score points: the vendor's overall score.
• A group: the total for one score group, such as Data sensitivity. Each group can be its own condition.

Then set the score or range to match. For example, a rule can give High when Data sensitivity is 8 or more, whatever the Access level score is.

Groups appear in your rules only after you save them on the Risk score tab.

If a vendor matches more than one rule, the highest risk level applies. If the form has no scored questions, score conditions never match and your default risk level applies.

For how scores are calculated, see Set a risk score for vendor intake in Titan AI.

Example

Say your form asks about the type of data shared with a vendor and their business impact. You could set up rules like this:

1. If data type shared is PI or sensitive AND business impact is Medium or High, then risk level is High.
2. If data type shared is PI or sensitive AND business impact is Low, then risk level is Medium.
3. If business impact is High (regardless of data type), then risk level is Medium.
4. Default: risk level is Low.

With these rules in place, a vendor who reports sharing sensitive data with a medium business impact matches rule 1 and is scored High. They'd also satisfy rule 3, which gives Medium, but High is the highest match, so High applies. A vendor who reports no sensitive data and a low business impact doesn’t match any rule, so they fall through to the default of Low.

Example with score groups

Say you grouped your scored questions into Data sensitivity and Access level, and set up these rules:

A vendor that scores 9 on Data sensitivity and 9 on Access level matches both rules. Rule 1 gives High and rule 2 gives Medium, so the risk level is High, the highest of the two.

Publish the form

Before you can publish, go to the Access tab and add at least one allowed email address or domain. This is the allowlist of who can use your public form. Once you’ve added one, select Publish form in the header. Publishing makes the form live at its public link and starts collecting submissions; you can unpublish it at any time. Unpublishing takes effect immediately: anyone in the middle of filling out the form when you unpublish will be unable to finish or submit it.

After a request comes in

The risk level generated by these rules appears on the request when you review it, and carries over to the vendor's record when you approve the request. You can still adjust it by hand at that point if needed. The risk score also shows on the request, including completed requests.